herootx Goto Github PK

activity-log-export-automation

Connect Splunk to Azure Activity Log via PowerShell automation

amsi-tracer

Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) passed into AMSI during dynamic execution.

awesome-memory-forensics

A curated list of awesome Memory Forensics for DFIR

awesome-search-engines-for-cybersecurity-researchers

Awesome list of Search Engines for Cybersecurity Researchers

awesome_incident_response

Awesome Incident Response

blacklotus

BlackLotus UEFI Windows Bootkit

burpbounty

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

cerez

Cerez 😈 LD_PRELOAD rootkit

chatgpt

🔮 ChatGPT Desktop Application (Mac, Windows and Linux)

cloudtracker

CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.

collect-memorydump

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

containyourself

A POC of the ContainYourself research presented in DEF CON 31, which abuses the Windows containers framework to bypass EDRs.

detection-rules

Rules for Elastic Security's detection engine

dongleme

Feitian Rockey4ND dongle testing

dumpit-linux

Compiled code for the memory acquisition tools for Linux provided by Magnet Forensics

dwarf2json

dwarf2json Binary

exam-testing-engine-vumingo

Free full version of exam testing engine vumingo

findcrypt-yara

IDA pro plugin to find crypto constants (and more)

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

godpotato

hiddendesktop

HVNC for Cobalt Strike

iat_patcher

Persistent IAT hooking application - based on bearparser

imhex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

libdwarf-code

Contains source for libdwarf, a library for reading DWARF2 and later DWARF. Contains source to create dwarfdump, a program which prints DWARF2 and later DWARF in readable format. Has a very limited DWARF writer set of functions in libdwarfp (producer library). Builds using GNU configure, meson, or cmake.

libdwarf_binary

lime

Linux Memory Extraction

lms.netmap

ltesniffer

An Open-source LTE Downlink/Uplink Eavesdropper

malwoverview

Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, ThreatCrowd, Malware Bazaar, ThreatFox, Triage and it is able to scan Android devices against VT and HA.

mdump